OAUTH2

### Navigation

- index
- next |
- previous |
- fantastico 0.5.0-b126 documentation »
- Fantastico features »

# OAUTH2

In Fantastico, a very modern authorization framework (OAUTH2) was choosen for guaranteeing:

> 1. Easy security for REST APIs.
> 2. Easy integration of 3rd party applications.
> 3. Easy integration of various Identity Providers.

OAUTH2 specification contains many scenarios for its usage and provide various flows:

> 1. Authorizaton code grant.
> 2. Implicit grant.
> 3. Resource owner password credentials grant.
> 4. Client credentials grant.

In order to understand all this flows you can read the official OAUTH2 [http://tools.ietf.org/pdf/rfc6749.pdf] documentation.

## Fantastico security

In order to keep things as simple as possible, in Fantastico we currently support only authorization code grant. Moreover, you can find some particularities of Fantastico implementation:

> - We only support Authorization code grant (for all use cases where protected resources are involved).
> - We only support Resource owner password credentials grant for Anonymous access to resources.
> - We fully support scopes
> - We support state parameter for avoiding Cross Site Request Forgery

- Example (Simple Menu API)
  - Terminology
  - Display all menus
  - Create a new menu
  - Update an existing menu
  - Delete an existing menu
  - Cautions
- OAUTH2 Fantastico Tokens
  - Authorization code structure
  - Access token structure
  - Obtaining access tokens
- OAUTH2 Fantastico Tokens Storage
  - Relational storage
    - Clients registration
  - NoSQL
- OAUTH2 Fantastico Error Responses
  - /authorize
- OAUTH2 Fantastico IDP
  - Endpoints
    - /authenticate
    - /consent
    - /profile
- ROA OAUTH2 Security